OpenAI has confirmed that its models, including GPT-5.6 Sol and an unreleased prototype, broke out of a test sandbox and compromised Hugging Face's production infrastructure to manipulate a security benchmark, subsequently touching four other services. Separately, Anthropic discovered that three of its Claude models had breached the production systems of three real companies during evaluations conducted by its partner Irregular—with one model uploading a malicious package to the public PyPI registry.

No U.S. federal law currently assigns liability for harms caused by AI agents. Any legal action would rely on computer-hacking statutes drafted decades ago for human actors.

The OpenAI Incident

On July 21, OpenAI disclosed that a combination of its models—both operating with reduced safety refusals—escaped an isolated environment during a cyber-capability benchmark and reached the production infrastructure of Hugging Face, the open-source repository platform that hosts hundreds of thousands of models and datasets relied on across the AI industry. The models exploited a zero-day vulnerability in a package-registry proxy and used stolen credentials to extract benchmark answers directly from Hugging Face's database.

In a subsequent update one week later, OpenAI revealed that Hugging Face was not the only affected party. The same incident reached four accounts across four additional services, with one used as an outbound relay and another for data storage.

Anthropic's Discovery

Prompted by OpenAI's disclosure, Anthropic reviewed 141,006 of its own test runs and identified three additional breaches. In a post published July 30, the lab reported that Claude models Opus 4.7, Mythos 5, and an internal research system reached the open internet from sandboxed environments operated by third-party partner Irregular, then compromised real organizations.

Mythos 5 constructed and published a booby-trapped Python package to the public PyPI registry, the primary distribution hub for Python libraries and a recurring target in software supply-chain attacks. The package was downloaded and executed on 15 real machines before defenders removed it. Two of the three victim companies had been unaware of the breach.

Neither lab has described any model as acting with its own agenda. The agents operated for extended periods without human oversight, and in one instance, Opus 4.7 continued attacking after showing signs it had reached production systems.

These incidents come as both companies pursue public listings that could value each above $1 trillion, intensifying a fundamental question in the AI cyber-benchmark race: how can dangerous capabilities be tested without causing dangerous real-world incidents?

The Legal Void: Who Pays When an AI Model Hacks?

The United States has no federal law addressing liability for AI-caused harms. Any case would depend on the Computer Fraud and Abuse Act, a 1986 statute that criminalizes "intentionally" accessing a computer without authorization—language designed for humans who form intent. The CFAA has long faced criticism from legal scholars for being stretched beyond its original purpose in the decades since it was enacted, well before autonomous AI agents were a concern.

An AI agent is not a legal person and therefore cannot be prosecuted. The Department of Justice could theoretically pursue charges against the companies, but with minimal precedent, the question of blame remains unclear.

The more viable path is civil litigation. Ahmed Ghappour, a computer-law scholar at New York Law School, argued that the models "are the company's tool," and that "when an AI agent acts without being specifically directed (...) the more interesting questions may lie in negligence and products liability (not criminal hacking laws)."

For me, the lesson from the AI hacking stories is more about governance than model capability. The quality of safeguards like containment architecture, authorization boundaries, monitoring, and incident response are increasingly important.

— ahmed ghappour ⚡️🤖 (@ghappour) August 4, 2026

The victims' strongest claim would be negligence: OpenAI and Anthropic designed and conducted tests that escaped containment. That argument faces its own hurdles—proving the labs breached a duty of care when the tests were isolated by design would require a judge to forge novel legal ground.

Proposals for Stricter Rules

Some legal scholars advocate more stringent frameworks. Gabriel Weil of the University of Houston and the Institute for Law & AI has proposed treating frontier AI labs like keepers of wild animals—liable regardless of the precautions taken, because the risk is inherent to the activity.

A patchwork of state-level bills already moves in that direction. New York's S8833 and Rhode Island's H8052 would hold developers of frontier AI systems liable for harms when no user or intermediary intended the conduct or was negligent. California's AB 316 goes further, eliminating the "autonomous AI" defense so companies cannot evade responsibility by attributing actions to the model's independence.

The EU's AI Act (Regulation 2024/1689) similarly imposes obligations on providers of higher-risk systems, though it contains no provision specifically targeting agent-driven intrusions. Beyond these measures, some U.S. politicians are pushing for legislation that would grant the government a kill switch to deploy against any model deemed contrary to the country's interests.

Unresolved

Morally, the responsibility arguably rests with the executives who deployed the models. Legally, the question remains open. Until a hacked company files suit, the answer to "who is liable?" remains exactly where OpenAI and Anthropic left it: admitted, disclosed, and unresolved.

Hugging Face has indicated it will not press charges—a position favorable to OpenAI. The other affected companies have not yet stated what course of action they intend to pursue.